Skip to content
Cloud Efficiency Hub

Inefficient Private Link Routing to Azure Databricks

The short version

In Azure Databricks environments that rely on Private Link for secure networking, it's common to route traffic through multi-tiered network architectures.

Benjamin van der Maas

Manager, Cloud FinOps @ Johnson & Johnson

Azure service
Azure Databricks
Category
Networking
Reference
CER-0068
Type
Inefficient Configuration

Explanation

Why the waste happens and who it affects.

This often includes multiple VNets, Private Link endpoints, or peered subscriptions between data sources (e.g., ADLS) and the Databricks compute plane. While these architectures may be designed for isolation or compliance, they frequently introduce redundant routing paths that add cost without improving performance. Each additional hop may result in duplicated Private Link ingress and egress charges. Without regular review, this can create persistent and unrecognized network inefficiencies tied to Databricks usage.

Billing model

The pricing dimensions that drive this cost.

Azure networking charges are incurred based on:

  • Private endpoint hourly charge (per endpoint) plus Private Link inbound and outbound data processing (per GB)
  • VNet peering ingress/egress (per GB)
  • Regional vs. cross-region data transfer

Unnecessary network hops can compound these charges, even when they serve no functional or security purpose.

How to detect

5 checks to find it in your estate.

  • Review network costs in the Azure subscription hosting your Databricks environment
  • Identify high Private Link ingress charges or VNet peering transfer fees
  • Trace end-to-end data paths between storage and Databricks compute
  • Count how many Private Link or peering hops exist along the path
  • Assess whether all network segments are functionally required

How to fix

4 ways to remove the waste.

  • Simplify routing by colocating Databricks and storage in the same region and reaching storage through a single private endpoint, or through service endpoints (no extra charge) where security policy allows
  • Eliminate redundant Private Link endpoints that add no security or compliance value
  • Use direct peering or shared services models to reduce network traversal
  • Continuously audit Databricks data paths to align architecture with minimum-cost, minimum-hop configurations

Documentation

Vendor references for pricing and configuration.